Privacy Policy

1. Overview

This Privacy Policy explains how Metta Health Ltd ("we", "us", "our") collects, uses, discloses, and protects personal data when you visit our site, buy digital products, download files, book strategy calls, or contact us for support.

Metta Health Ltd is a company registered in England and Wales. Registered office: 128 City Road, London, United Kingdom, EC1V 2NX. Company number: 11829572.

2. Information We Collect

• Contact & account data: name, email address and any information you provide when contacting us.
• Order, payment, and refund data: product purchased, price, currency, Stripe checkout and payment references, invoice and receipt information, payment status, refund status, download entitlement, and support history. We use Stripe to process payments; we do not store full card details on our servers.
• Strategy call and health-related data: if you book a strategy call, we collect your appointment choice, contact details, proposed treatment or procedure, destination or providers being considered, current situation, travel requirements, consent records, and the questions you ask us to review. This may include health information, which is special category personal data.
• Zoom meeting data: meeting identifiers, joining links, scheduled time, host information, and basic attendee connection data created or processed when a strategy call is scheduled or joined.
• Technical data: IP address, browser type, device information and pages visited (collected via server logs and any analytics tools we use).
• Cookies and tracking: cookies and similar technologies to provide site functionality and analytics.

3. How We Use Your Information

We use personal data to:

• Provide, maintain and deliver Products and services, including download access and strategy call bookings.
• Reserve and administer strategy call appointments, review the information you submit before the call, deliver the call, and keep an appropriate service record.
• Create Zoom meetings, send joining details, and send appointment reminders.
• Process payments, refunds, receipts, invoices, and fraud prevention checks.
• Communicate order confirmations, booking confirmations, updates, and support messages.
• Send transactional emails, including purchase confirmations, receipts, download links, invoices, booking confirmations, Zoom joining details, appointment reminders, access support, and service notices.
• Send marketing or follow-up emails about related Metta Health products, services, resources, or offers where permitted by law or with your consent.
• Improve our website and monitor usage.

4. Cookies & Analytics

We use essential cookies and local storage for site functionality, checkout, security, downloads, forms, and remembering your cookie choices. Essential cookies are needed to provide the site and services you request.

Non-essential analytics or advertising cookies, pixels, and similar technologies, including Matomo analytics where enabled, are only used where they are enabled and you have given consent through our cookie choices banner or consent controls. You can accept, reject, or manage non-essential cookies through those controls. You can also manage or disable cookies via your browser settings, but disabling certain essential cookies may affect site functionality.

5. Marketing & Follow-Up Emails

Transactional emails are messages we need to send to complete or support your purchase, such as receipts, download access, invoices, product access information, booking confirmations, Zoom joining details, appointment reminders, security notices, and customer support replies.

Marketing and follow-up emails may include related resources, education, offers, strategy-call invitations, upsells, or information about similar products and services. We send these where you have consented or where applicable law allows us to contact existing customers about our own similar products or services and an opt-out has been offered.

You can unsubscribe from marketing or follow-up emails at any time by using the unsubscribe link in the email where provided, replying to the email, or contacting support@mettahealth.uk. We keep suppression or do-not-contact records so that we can honour opt-outs. We may still send transactional or service emails where necessary to fulfil your order, provide support, or meet legal obligations.

6. Infrastructure, Processors & Services

We use a mix of self-managed services and selected third-party providers to operate the site, deliver Products, communicate with customers, measure site performance, and process payments. Where a provider processes personal data for us, we use appropriate data processing terms or GDPR compliance agreements.

This self-managed approach is intended to enhance the protection of client data by limiting unnecessary third-party processing and giving us greater direct control over security configuration, access permissions, data location, backups, and monitoring.

• Payment processor: Stripe processes checkout information, payment method details, fraud prevention checks, receipts, invoices, refunds, and related payment data.
• Hosting and VPS infrastructure: our shop, database, email, email-list, CRM, and analytics services are primarily self-managed on VPS infrastructure based in the EU. Our hosting service provider is netcup, with GDPR compliance agreements in place.
• Website and shop platform: shop services that we manage to operate and secure our shop pages, checkout, forms, downloads, booking records, and related website functionality.
• Email, CRM and email-list services: we primarily manage these services ourselves on our VPS infrastructure. They are used to send transactional emails, support replies, customer follow-up sequences, marketing emails, unsubscribe records, reminder emails, and customer relationship records.
• Video conferencing provider: Zoom processes strategy-call meeting identifiers, joining details, host details, and attendee connection data when a strategy call is scheduled or joined.
• Analytics: we use self-managed Matomo analytics on our infrastructure to help us understand site usage, product page performance, and campaign effectiveness where analytics are enabled and consent is required.
• Files, logs and backups: website files, databases, logs, backups, downloads, and related records are hosted and maintained through our self-managed shop infrastructure and hosting provider.

External services such as Stripe, Zoom, and netcup have their own privacy notices and security practices. We recommend reviewing their policies where relevant.

7. Data Security

We implement reasonable technical and organisational measures to protect personal data. However, no transmission over the internet can be guaranteed completely secure; we cannot promise absolute security.

8. Data Retention

We keep personal data only as long as necessary to fulfil the purposes described in this policy, comply with legal obligations, or resolve disputes. Purchase, invoice, refund, and accounting records may be kept for the period required for tax, accounting, and legal record-keeping. Strategy call intake and appointment records are retained only for as long as reasonably needed to prepare for and deliver the service, provide follow-up support, maintain financial and service records, and handle legal or regulatory matters.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete or restrict processing of your personal data. To exercise these rights, contact us using the details below.

10. UK GDPR, Data Protection Act 2018 and, where applicable, EU GDPR

As Metta Health Ltd is a UK company, this section explains additional rights and information under the UK GDPR and Data Protection Act 2018. Where applicable, it also covers rights under the EU General Data Protection Regulation (EU GDPR).

• Data controller: Metta Health Ltd. Contact: support@mettahealth.uk.
• Lawful bases for processing: performance of a contract (to provide products and booked services), consent (where requested, including non-essential cookies and certain marketing), legitimate interests (to operate, secure, support, and improve the site), and compliance with legal obligations.
• Health and other special category data: where a strategy call intake includes health information, we rely on your explicit consent under Article 9(2)(a) UK GDPR in addition to the applicable Article 6 lawful basis. You may withdraw that consent by contacting us, although this does not affect processing already carried out and may mean we cannot prepare for or provide the strategy call.
• Your GDPR rights: access, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection to processing, and the right to withdraw consent at any time where processing is based on consent.
• How to exercise rights: email us at support@mettahealth.uk. We may ask for information to verify your identity before actioning requests.
• Complaints: if you are unhappy with our handling of your personal data you may lodge a complaint with your local supervisory authority (for UK residents: the Information Commissioner's Office — https://ico.org.uk).
• International transfers: where data is transferred outside the UK or EEA, we will use appropriate safeguards where required, such as adequacy regulations, the UK International Data Transfer Agreement or Addendum, or Standard Contractual Clauses.

11. International Transfers

Data may be transferred to and processed in countries outside your own where external services such as payment processing or video conferencing require it. Our core shop, email-list, CRM, and analytics services are primarily self-managed on EU-based VPS infrastructure. When international transfers occur, we take steps to ensure appropriate safeguards are in place where required.

12. Children

Our site and Products are not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us to request deletion.

13. Changes to This Policy

We may update this Privacy Policy. We will post the updated version on this page with a revised effective date.

Contact

For questions or to exercise your data rights, contact us at support@mettahealth.uk.